Multi-Turn Narrative Escalation

• Multi-turn narrative escalation is the progressive restructuring of narrative context over successive turns, where later meanings rely on prior dialogue.
• It applies to narrative analysis, LLM safety, and agent evaluation by revealing how sequential phase transitions shape risk profiles and narrative outcomes.
• Techniques like turn-level credit assignment, hierarchical attention detection, and RL-based evaluation demonstrate its impact in domains from screenplay analysis to multi-turn safety benchmarks.

Multi-turn narrative escalation denotes the progressive reconfiguration of a narrative, dialogue, or agent trajectory across successive turns, such that later states acquire meaning only through accumulated prior context. In narrative analysis, it refers to sequences of turning points that move a plot from setup through complications to climax and aftermath; in LLM research, it refers to gradual shifts in intent, risk, confidence, or control that single-turn analyses miss. Across work on screenplay structure, jailbreaks, harassment, scam simulation, multimodal safety, reinforcement learning, and agent evaluation, the common object is a trajectory: escalation is encoded not in one utterance, but in the ordering, dependency, and phase structure of many utterances or actions (Papalampidi et al., 2019, Li et al., 7 Apr 2025).

1. Narrative-theoretic foundations

A foundational formulation comes from screenplay analysis, where turning points are treated as the moments that “determine the progression of the plot.” In that framing, escalation is not reducible to a single climax. Rather, a screenplay is segmented by recurrent narrative beats such as setup or exposition, complications, major setback or point of no return, climax, and aftermath or resolution. Gold-standard turning points tend to include an introductory sentence, several major and intense events, and a final sentence describing the ending. What matters is not arbitrary salience, but state change: rising conflict, increased tension, changed stakes, and either resolution of a subproblem or escalation into a more serious one (Papalampidi et al., 2019).

This view makes multi-turn escalation intrinsically sequential. In examples such as Juno, Panic Room, and The Shining, successive turning points track decisions, entrapment, warnings, medical emergencies, revelations, rescue, confrontation, and ending states. The central implication is that narrative movement is distributed across several pivots, not concentrated in one event. Turning-point identification therefore supplies a compressed representation of long-form narrative development and can support summarization, question answering, and narrative analysis precisely because it captures phase transitions rather than isolated facts (Papalampidi et al., 2019).

A structurally similar argument appears in computational mental-health analysis. There, narrative organization is modeled at three levels: micro-level lexical features, meso-level semantic embeddings, and macro-level LLM narrative evaluation. The main claim is that macro-level organization carries the strongest signal, because distress is expressed most strongly in how a narrative is organized rather than which words it contains. Formal structures such as Labov’s story grammar, RST coherence, and propositional composition are used to assess whether a narrative is temporally ordered, causally connected, and moving toward resolution or closure. This suggests that escalation can be operationalized as structural reorganization of the discourse itself, not merely as an increase in negative wording (Ma et al., 30 Apr 2026).

2. Escalation as a conversational attack pattern

In LLM safety research, multi-turn narrative escalation is typically defined by the distribution of harmful intent across apparently benign turns. The harmful objective is deferred, scaffolded, reframed, or normalized until it becomes the “natural” continuation of the dialogue. This logic appears in slow-drift jailbreaks, role manipulation, harassment, scams, and multimodal contextual safety, all of which treat conversational history as the attack surface rather than as incidental context.

Work	Multi-turn mechanism	Reported observation
"Well, that escalated quickly: The Single-Turn Crescendo Attack (STCA)" (Aqrawi et al., 2024)	Simulates prior multi-turn escalation inside one prompt	Direct harmful asks are often refused, while the compressed escalation often succeeds
"Automating Deception: Scalable Multi-Turn LLM Jailbreaks" (Kumarappan et al., 24 Nov 2025)	Five-turn FITD templates with benign pretext, legitimacy claim, and harmful final ask	GPT-family ASR can increase by as much as 32 percentage points with history
"The Echo Chamber Multi-Turn LLM Jailbreak" (Alobaid et al., 9 Jan 2026)	Repeated elaboration on the model’s own prior outputs	Overall ASR 45.0%, above Crescendo at 28.6% and DAN at 9.5%
"Echoes of Human Malice in Agents" (Padhi et al., 16 Oct 2025)	Repeated-game harassment with memory, planning, and fine-tuning attacks	Fine-tuning drives ASR to 95.78–96.89% in LLaMA and sharply lowers refusal
"The Anatomy of Conversational Scams" (Yuan et al., 6 Jan 2026)	Staged scam dialogue with legitimacy, pressure, and transactional extraction	Scam interactions follow recurrent escalation patterns and defensive counter-patterns

The single-turn variant STCA is notable because it compresses escalation into one prompt rather than removing it. Its mechanism is to embed a simulated back-and-forth—“Earlier, I said… You responded… Then I asked…”—so that the model encounters a harmful request only as the final step of an already-normalized trajectory. The attack relies on narrative priming and pattern continuation: the harmful target is framed as the next logical step in a conversational sequence rather than as a direct isolated request (Aqrawi et al., 2024).

Automated FITD attacks formalize a similar structure at scale. For illegal activities, the five-turn template moves from “What is <illegal activity>?” through legal consequences and historical examples to a research-pretext request for how the activity is carried out, ending with “How could someone attempt <illegal activity> without being caught?” In the reported experiments, GPT-4o Mini rises from 0.70% without history to 33.50% with history on illegal activities; GPT-4o rises from 27.40% to 59.40%; Gemini 2.5 Flash remains nearly immune, with average ASR with history of 0.10% (Kumarappan et al., 24 Nov 2025).

Echo Chamber uses a different escalation mechanism. It begins with “poisonous seeds” and “steering seeds,” samples multiple continuations, selects a promising path, and then repeatedly asks the model to elaborate on its own earlier text. The attack is explicitly described as leveraging consistency bias and completion bias. In the reported automated evaluation on AdvBench, Echo Chamber reaches 45.0% overall success rate, compared with 28.6% for Crescendo and 9.5% for DAN; it is especially effective on procedural harmful artifacts such as Weapon at 100.0% and CorpHack at 85.7% (Alobaid et al., 9 Jan 2026).

Harassment and scam benchmarks extend escalation from prompt engineering to social process. In the Online Harassment Agentic Benchmark, conversations run for up to 10 turns and are evaluated over the first five turns with turn-wise metrics: Attack Success Rate, Refusal Rate, and Turns to Success. The benchmark models a repeated game between harasser and victim, with the victim exhibiting appeasement, deflection, or withdrawal. Turn-level prevalence reveals differing escalation shapes: fine-tuned LLaMA shows Flaming increasing from 29% at turn 1 to 61.77% at turn 5 and Insult from 41.57% to 68.35%, whereas non-finetuned LLaMA often spikes early and then cools off (Padhi et al., 16 Oct 2025).

Scam simulation yields an explicitly phased escalation envelope. The reported attacker strategy families include Authority Pressure, Urgency Creation, Threat of Loss, Information Harvesting, Channel Shift, Credential Engineering, Reciprocity, Sunk-cost Trap, Rapport Building, and Payment Engineering. These are summarized as four broad stages: context framing, psychological pressure, trust and isolation, and transactional exploitation. Victim defenses mirror this structure with authority verification, deliberate delay, channel control, and data minimization, which indicates that escalation is not merely a rise in aggression but a contest over conversational tempo, legitimacy, and commitment (Yuan et al., 6 Jan 2026).

3. Turn-level modeling and credit assignment

A central technical claim across recent agent-learning work is that multi-turn escalation cannot be modeled faithfully when credit is assigned at the wrong granularity. In interactive settings, the meaningful unit is often the whole turn—one environment query plus one full model response—not the token. Turn-PPO makes this point explicitly by arguing that the standard token-level MDP used by GRPO and token-PPO is a poor fit for interactive tasks because within-turn token transitions and across-turn environment updates are heterogeneous. The paper calls this “state representation misalignment” and replaces the token-level MDP with a turn-level MDP. Advantages are then estimated at turn granularity, with intermediate turns using

$\hat A_n^i \approx \gamma V_{n+1}-V_n,$

and the final turn using

$\hat A_N^i = r - V_N.$

On WebShop and Sokoban, the reported pattern is that GRPO often crashes, token-PPO is more stable, and turn-PPO is better still (Li et al., 18 Dec 2025).

TRACE makes an analogous argument for RL-based multi-turn jailbreaking. Its core claim is that trajectory-level outcome rewards broadcast uniformly to all turns are wrong because turn contributions are non-uniform, phase-dependent, and target-specific. TRACE redistributes the original outcome advantage with a turn-aware term,

$$\hat{A}_{i,t}=m_{i,t}\hat{A}^{o}_{i}+\hat{A}^{p}_{i,t},$$

where $m_{i,t}$ depends on whether the trajectory succeeded or failed, and $\hat{A}^{p}_{i,t}$ adds a refusal-aware local penalty. The leave-one-turn-out analysis is especially important: in successful trajectories, 47.1% of turns are attack-critical and 52.9% redundant; in failed trajectories, 94.1% are neutral and only 5.9% safety-critical. The paper further distinguishes phase-specific failure modes, notably premature exposure and harmfulness drift, showing that the timing of escalation matters as much as the content (He et al., 9 May 2026).

Training instability under long horizons appears in distillation as well. TCOD identifies “Trajectory-Level KL Instability” in vanilla on-policy distillation for multi-turn agents: as student errors accumulate across turns, later histories move beyond the teacher’s effective support, KL escalates, and success rate collapses. TCOD addresses this with a temporal curriculum over trajectory depth, either forward-to-backward or backward-to-forward. Across ALFWorld, WebShop, and ScienceWorld, the reported result is improvement by up to 18 points over vanilla OPD, along with reduced training time by up to 32% and substantially more stable KL trajectories (Wang et al., 27 Apr 2026).

A broader implication is that escalation is not only something to detect after deployment. It is also a training-time object. The relevant modeling questions are which turns are pivots, which are redundant, how far early actions propagate, and whether supervision should privilege setup turns, payoff turns, or both.

4. Detection and defensive control

If harmful or high-risk intent is distributed across turns, then moderation at the level of isolated utterances is structurally incomplete. This motivates conversation-level detectors and temporally aggregated defenses. A clear instance is the hierarchical attention transformer for jailbreak detection, which treats the dialogue as a sequence $C=(x_1,\dots,x_T)$ with a binary conversation label $y\in\{0,1\}$ and estimates $p(C)=\Pr(y=1\mid C)$. The architecture separates local turn encoding from global dialogue reasoning: a TurnEncoder produces compact turn representations, and a ConvTransformer applies self-attention over turns plus cross-attention to token-level memory. On a benchmark of 14,038 conversations, the reported performance is Precision 95.90%, Recall 92.10%, F1 0.9394, and False Positive Rate 2.80%, outperforming Claude Opus 4.7 by 0.07 F1 while about halving false positives. Attention analysis shows that jailbreak conversations draw relatively more attention to later turns, especially user turns where the adversarial payload emerges (Hu et al., 19 Jun 2026).

THRD addresses the same problem from an inference-time defense perspective. It models temporal risk accumulation with four modules: Turn-level Risk Assessor, Historical Context Analyzer, Response Evaluator, and a Decision Module that combines current-turn risk, historical intent, response facilitation, attenuation-based modulation, and monotonic-trend adjustment. The design premise is that dialogue history continuously reshapes the model’s conditioning context, so risk is trajectory-dependent. Against X-Teaming and Tempest on Qwen2.5-7B-Instruct and Llama-3-8B-Instruct, THRD reportedly reduces ASR to 0.2–4.0% while preserving utility within about 1.5% degradation on MMLU and GSM8K. The first-rejection analysis is particularly diagnostic: over 70% of attacks require Turn 2 or later to detect, which directly supports the need for temporal aggregation (Ma et al., 1 Jun 2026).

CivicShield generalizes this logic into a defense-in-depth architecture for government-facing chatbots. Its seven layers include zero-trust capability controls, perimeter validation, a semantic firewall, a conversation state machine with safety invariants, behavioral anomaly detection, multi-model consensus, and graduated human-in-the-loop escalation. The formal model includes asymmetric trust dynamics,

$$\tau(t{+}1) = \text{clamp}\big(\tau(t) + \alpha \cdot \mathbb{1}[B(t)] - \beta \cdot g(a(t)) \cdot \mathbb{1}[A(t)],\; 0,\; \tau_{max}\big),$$

with $\alpha \ll \beta$, so trust rises slowly on benign turns and falls quickly on adversarial ones. In simulation on 1,436 scenarios, the reported combined detection rate is 72.9% with 2.9% effective false positive rate after graduated response, alongside 100% detection of multi-turn crescendo and slow-drift attacks (Patil, 30 Mar 2026).

These defenses also reveal an important controversy: added protection is not universally monotone. In some settings, a guardrail stack or advisor improves one model and degrades another. This is not an incidental implementation detail; it reflects the fact that escalation is model-conditional, and that defense components themselves interact with model style, action formatting, and state representation.

5. Benchmarks, objective harm, and measurement limits

Recent benchmarks formalize multi-turn escalation as an evaluation problem in its own right. MTMCS-Bench does so for multimodal dialogue by constructing paired safe and unsafe conversations around the same image under two settings. Type A is escalation-based risk: $\hat A_N^i = r - V_N.$0 is benign, $\hat A_N^i = r - V_N.$1 becomes ambiguous, and $\hat A_N^i = r - V_N.$2 is harmful only in the full dialogue context. Type B is context-switch risk: $\hat A_N^i = r - V_N.$3 is explicitly harmful, while later turns look benign but remain unsafe because they continue the original objective. The benchmark contains 752 base images, 2,256 image variants, 12,032 dialogues, 18,048 evaluation questions, and 30,080 total samples. Its findings are that Type B is generally easier, whereas Type A—gradual emergence of risk—is harder and exposes a persistent safety–utility trade-off in current MLLMs (Liu et al., 11 Jan 2026).

NRT-Bench moves escalation into safety-critical control. It evaluates a five-role operator team in a simulated nuclear power plant control room, where attackers inject messages over four channels in bounded multi-turn sessions with per-turn feedback. Harm is objective: a run terminates when any of six critical safety functions is lost. Under paired replay, the reported attack success range across four operator models is 8.7% to 12.1%. Yet aggregate rates hide major heterogeneity: of 149 replayed sessions, none defeat all four models, while 50 defeat at least one, implying nearly disjoint vulnerability sets rather than nested robustness orderings (Lee et al., 18 Jun 2026).

The limits of current evaluation practice are especially visible in production judging. In a deployed food-and-beverage ordering agent, exhaustive human transcript review identified systematic defects in confirm-gates, cart state, stale referents, escalation lockout, and recovery logic that a built-in LLM judge largely failed to surface. The judge catches some turn-local issues, but not the cross-turn failures that dominate multi-turn behavior. The reported batch-level figures are stark: 2 of 9 systematic patterns surfaced in one batch, and zero of 100 rounds flagged in another batch where humans confirmed 23 defects and 7 new cross-cutting patterns. The paper’s diagnosis is that this is a routing-and-wiring failure as much as a perception failure: the rubric has no category for state-tracking, guardrails, recovery, or safety, and the operational gate is disconnected from the quality scores (Zhang et al., 9 Jun 2026).

The survey literature places these benchmarks in a broader taxonomy. Multi-turn interaction is repeatedly framed as a trajectory problem involving context management, cumulative errors, contextual drift, feedback responsiveness, persona maintenance, and adversarial steering. Benchmarks such as MT-Bench, MT-Bench-101, MT-Eval, roleplay evaluations, and jailbreak datasets are therefore not interchangeable single-turn tests with longer histories; they probe different forms of persistence, interference, and degradation over time (Li et al., 7 Apr 2025).

6. Beyond safety: confidence drift, agent planning, and broader significance

A common misconception is that escalation in multi-turn systems always means stronger confidence or more explicit commitment. The study of Self-Anchoring Calibration Drift shows otherwise. SACD is defined as a systematic nonzero change in expressed confidence across turns when later responses build on the model’s own earlier outputs:

$\hat A_N^i = r - V_N.$4

The reported findings are heterogeneous. Claude Sonnet 4.6 shows significant confidence suppression with mean CDS = -0.032 and significant calibration error drift; GPT-5.2 shows the opposite tendency in open-ended domains, with significant ECE escalation by Turn 5; Gemini 3.1 Pro shows no significant CDS but exhibits suppression of natural calibration improvement under self-anchoring. Multi-turn escalation, in this sense, can take the form of confidence increase, confidence decrease, or persistent miscalibration (Harshavardhan, 1 Mar 2026).

Escalation also appears in agentic planning. PenTest2.0 treats privilege escalation not as a one-shot exploit recommendation but as a turn-based loop in which the system probes a target, summarizes state, proposes one command in JSON, executes it, checks for root, updates command history and optional task trees, and tries again. Its contribution is precisely that the LLM must sustain a narrative of what has been tried, what failed, and what should follow next. Across seven tested configurations, all achieved root in a controlled Linux target, but only four achieved automatic root detection; the strongest configuration was --cot --hint, which reached root in Turn 1 in one run and by Turn 2 in others (Al-Sinani et al., 9 Jul 2025).

Across these domains, a stable pattern emerges. Multi-turn narrative escalation is phase-sensitive, delayed-payoff, and frequently non-local: early turns may be safe-looking but indispensable, later turns may appear neutral but inherit prior risk, and outcome metrics that ignore turn structure routinely miss the decisive mechanism. This suggests that the most informative representations of escalation are those that preserve temporal order, role structure, and turn-level contribution, whether the object is a film plot, a harassment trajectory, a multimodal safety failure, a control-room breach, a scam dialogue, calibration drift, or an autonomous privilege-escalation loop.